Detections
Analytics

DKER-EE-001770 - Docker Incs official GPG key must be added to the host using the users operating systems respective package repository management tooling.

Information

All packaged components of Docker Enterprise are digitally signed using GPG keys maintained by Docker, Inc. The Docker Engine - Enterprise daemon, itself, is digitally signed. Furthermore, all Docker, Inc-managed Linux repositories are themselves signed using GPG keys. On Windows, if Docker is installed via the PowerShell PackageManagement (aka OneGet) provider, the provider is managed by Microsoft, and provider artifacts are signed by Microsoft. The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) installation images are digitally signed by Docker, Inc using Docker Content Trust.

Solution

For Linux systems, add Docker Inc's official GPG key to the host using the operating system's respective package repository management tooling. If not using a package repository to install/update Docker Engine - Enterprise, verify that the Engine's package signature matches that as published by Docker, Inc.

When retrieving the UCP and DTR installation images, use Docker, Inc's officially managed image repositories as follows:

docker.io/docker/ucp:[ucp_version]
docker.io/docker/dtr:[dtr_version]

If downloading the UCP and DTR images for offline installation, use only Docker, Inc's officially managed package links as follows:

https://docs.docker.com/ee/ucp/admin/install/install-offline/
https://docs.docker.com/ee/dtr/admin/install/install-offline/

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-Unix_V2R2_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-5(3), CAT|III, CCI|CCI-001749, Rule-ID|SV-235788r960954_rule, STIG-ID|DKER-EE-001770, STIG-Legacy|SV-104747, STIG-Legacy|V-95609, Vuln-ID|V-235788

Plugin: Unix

Control ID: 55471ea14abad00feba06f8869dd6d6a9b6fc0f0661234c912fff5f6917b592d